Abstract: In view of the poor effectiveness of the current Android browser communication protocol security test scheme, this paper proposes a vulnerability mining method based on Fuzzy Test Technology in generation mode. The scheme adopts the data block correlation model to describe the protocol under test, then according to the structure of the protocol automation test script generation deformity data corresponding to the package as a test case, and the generated test cases were sent to the abnormal test target, and monitor customer mobile phone browser is abnormal and record the abnormal information, analysis how to lead to abnormal error. Experimental results show that the proposed scheme can more fully exploit the mobile browser vulnerability caused by protocol analysis and fuzzy test, and has the certain reliability.

Key words: mobile browser, HTTP protocol, vulnerability mining, fuzzy testing, Mobile network security

摘要： 针对目前Android浏览器通信协议安全测试方案有效性较差的问题，本文提出了基于生成模式下模糊测试技术的漏洞挖掘方案。方案采用数据块关联模型描述被测协议，随后根据构造出来的协议测试脚本自动化生成相应的畸形数据包作为测试用例，并将生成的畸形测试用例随机发送到测试目标，同时监视手机浏览器客户端发生异常并记录异常信息，分析导致异常的错误如何发生。实验结果表明，该方案能更全面地挖掘出由协议分析结果和模糊测试发现的手机浏览器漏洞，具有一定的可靠性。

关键词: 手机浏览器, HTTP协议, 漏洞挖掘, 模糊测试, 移动网络安全